[ CVE-2025-61560 · Published 9 Oct 2026 ]

Vulnerability

CVSS 8.1 EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

BSI CERT-Bund7 Oct 2026WID-SEC-2026-3802

Argo CD: Multiple vulnerabilities Translated from German
CVE-2026-77459CVE-2026-113709CVE-2026-55797+2 more CVEs

[ References ]References

github.com/argoproj/argo-cd
github.com/argoproj/argo-cd/security/advisories/GHSA-4439-h7jw-5cjj

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

Argo CD: Multiple vulnerabilities Translated from German

[ References ]References